rhi/peerix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Reenable security again.

Browse source
This commit is contained in:
Sarah 2021-10-17 15:03:26 +02:00
parent 5d1d6f31d7
commit c2a5613e4f
No known key found for this signature in database
GPG key ID: 708F7ACE058F0186
1 changed files with 39 additions and 39 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

78
module.nix
View file

@ -61,49 +61,49 @@ in
User = cfg.user; User = cfg.user;
Group = cfg.group; Group = cfg.group;
# PrivateMounts = true; PrivateMounts = true;
# PrivateDevices = true; PrivateDevices = true;
# PrivateTmp = true; PrivateTmp = true;
# PrivateIPC = true; PrivateIPC = true;
# PrivateUsers = true; PrivateUsers = true;
# SystemCallFilters = [ SystemCallFilters = [
# "@aio" "@aio"
# "@basic-io" "@basic-io"
# "@file-system" "@file-system"
# "@io-event" "@io-event"
# "@process" "@process"
# "@network-io" "@network-io"
# "@timer" "@timer"
# "@signal" "@signal"
# "@alarm" "@alarm"
# ]; ];
# SystemCallErrorNumber = "EPERM"; SystemCallErrorNumber = "EPERM";
# ProtectSystem = "full"; ProtectSystem = "full";
# ProtectHome = true; ProtectHome = true;
# ProtectHostname = true; ProtectHostname = true;
# ProtectClock = true; ProtectClock = true;
# ProtectKernelTunables = true; ProtectKernelTunables = true;
# ProtectKernelModules = true; ProtectKernelModules = true;
# ProtectKernelLogs = true; ProtectKernelLogs = true;
# ProtectControlGroups = true; ProtectControlGroups = true;
# RestrictNamespaces = ""; RestrictNamespaces = "";
# NoNewPrivileges = true; NoNewPrivileges = true;
# ReadOnlyPaths = lib.mkMerge [ ReadOnlyPaths = lib.mkMerge [
# ([ ([
# "/nix/var" "/nix/var"
# "/nix/store" "/nix/store"
# ]) ])
# (lib.mkIf (cfg.privateKeyFile != null) [ (lib.mkIf (cfg.privateKeyFile != null) [
# (toString cfg.privateKeyFile) (toString cfg.privateKeyFile)
# ]) ])
# ]; ];
# ExecPaths = [ ExecPaths = [
# "/nix/store" "/nix/store"
# ]; ];
Environment = lib.mkIf (cfg.privateKeyFile != null) [ Environment = lib.mkIf (cfg.privateKeyFile != null) [
"NIX_SECRET_KEY_FILE=${toString cfg.privateKeyFile}" "NIX_SECRET_KEY_FILE=${toString cfg.privateKeyFile}"
]; ];